CVE-2026-58773

CVE-2026-58773 is an out-of-bounds write (CWE-787) in link_load_gnss_image of link_device.c, the modem link device driver in the Android kernel used on Google Pixel phones, where a missing bounds check allows memory corruption when a GNSS image is loaded. To trigger it, an attacker must already have System-level code execution on the device; no user interaction is required. Successful exploitation corrupts memory outside the intended bounds and can yield local escalation of privilege, effectively moving an attacker from System context to higher (kernel-level) privileges. The flaw affects Google Pixel devices running the affected modem link driver, so exposure is limited to attackers who have already compromised a device or an app with System privileges. No public proof-of-concept exists and the bug is not in CISA KEV, but reporting indicates signs of limited, targeted exploitation, so it should be treated as exploited in the wild.

What to do: Install the latest Google Pixel security update that addresses CVE-2026-58773 as soon as it is offered (Settings > System > System update), and verify the Android security patch level under Settings > About phone. Because exploitation requires System execution privileges and reporting suggests targeted misuse, prioritize high-risk users such as executives, journalists, and government personnel. There is no known remote mitigation; patching is the effective fix.